Loading story…
Researchers disclosed an agent-to-agent exploitation chain in Google’s open-source adk-python repository for the Agent Development Kit, showing how a low-privilege public-facing AI agent handling GitHub issues and pull requests could be prompt-injected into triggering a higher-privilege maintainer-only agent. The attack abused trusted handoffs between agents and GitHub workflow visibility to create a plausible malicious review trail, potentially steering maintainers toward merging poisoned pull requests and opening a software supply-chain compromise path.
The researchers also reported a second weakness in Antigravity SDK-based automation, where a command allowlist could be bypassed through Git scripting features to achieve remote code execution on the CI runner. Because the runner reportedly exposed a long-lived personal access token and Google Cloud service account credentials, even an unprivileged GitHub issue could have enabled secret exfiltration. Google said it fixed and hardened the repository and credited the report, while declining a bug-bounty payout because successful exploitation still depended on social engineering and maintainer action.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
Google confirmed that the second Antigravity-based vulnerability in the adk-python repository was remediated on July 21, 2026. The flaw had allowed agent-to-agent prompt injection to reach CI runner code execution and expose sensitive environment variables.
Dark Reading reports that after Pillar Security disclosed the initial agent-to-agent exploitation chain in early June 2026, Google remediated the first set of issues on July 9, 2026. This remediation preceded the separate July 21 fix for the second Antigravity-based weakness.
Pillar Security said that on July 2 it confirmed the affected Antigravity-based workflows in Google's adk-python repository had been removed. The removed workflows were part of the second attack path that allowed prompt injection from a public issue to reach a trusted fixing workflow.
After Pillar Security reported a second vulnerability involving Antigravity-SDK-based automation in the google/adk-python repository, Google fixed the weakness in late July. Pillar said the flaw could have enabled remote code execution without maintainer interaction.
Google deleted the issue-analyze, issue-fix, and pr-analyze GitHub Actions workflows from the public adk-python repository, stating they ran automated agents on untrusted issue and pull request content with broad repository credentials. The commit removed the exposed workflows as a mitigation while a safer design was considered.
Dan Lisichkin planned to discuss the findings at DEF CON's AI Village. The talk was scheduled for August 7.
After the initial disclosure, researchers found a second vulnerability in newly added Antigravity SDK-based automation in the same repository. They reported that a command allowlist could be bypassed via git scripting features to achieve CI runner code execution and potentially exfiltrate a long-lived personal access token and Google Cloud service account credentials from an unprivileged GitHub issue.
Google declined to award a bug bounty because it considered the exploit chain dependent on social engineering and maintainer action, but said it would recognize the report with credit. Another account states Pillar Security received an honorable mention for the disclosure.
After the disclosure, Google fixed the underlying repository issue and hardened the adk-python repository. Google confirmed the findings, said the demonstrated token had pull-request-related write permissions, and noted that maintainer action would still have been required to merge malicious code.
Pillar Security researchers disclosed a practical exploitation chain in Google's open-source google/adk-python repository, showing that a low-privilege public-facing AI triage agent could be prompt-injected into triggering a higher-privilege maintainer workflow. The reported path could fabricate a trusted approval trail for a malicious pull request and create a potential software supply-chain compromise route.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcedarkreading.com
Open sourceinfoworld.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcetheregister.com
Open sourcepillar.security
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed multiple vulnerabilities in enterprise AI agent frameworks that allowed attackers to bypass model authorization, trigger tools directly, and in some cases achieve **remote code execution**. Check Point reported 11 flaws across **LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK**, spanning insecure deserialization, **SSRF**, path traversal, and use-after-free. One critical issue in Microsoft Agent Framework let untrusted state data reach insecure checkpoint deserialization, enabling RCE; Microsoft fixed the bug and said no `CVE` was assigned because the product was not generally available. A separate disclosure described a cross-platform pattern dubbed **CoreBreak**, where execution layers in **Amazon Bedrock AgentCore, Google ADK, and Vercel AI SDK harnesses** accepted tool-call-shaped data without confirming that a legitimate model turn had authorized the action. AWS assigned **`CVE-2026-18830`** and automatically patched the managed service, Google fixed **`CVE-2026-18236`** in ADK for Python version **2.5.0**, and Vercel patched **`@ai-sdk/harness-codex` 1.0.29** and **`@ai-sdk/harness-opencode` 1.0.28**. Researchers said the findings show that the main risk lies in insecure agent orchestration and tool-execution logic, not prompt injection alone, with Google ADK also exposed to abuse that could write and run malicious Python code and leak API keys or cloud service account credentials.
Aug 6, 2026
Novee Security disclosed at Black Hat USA 2026 that AI coding agents tied to GitHub workflows can be manipulated through untrusted issue, pull request, and workflow-generated content to execute malicious actions inside repositories they are meant to maintain. Testing of **Anthropic Claude Code**, **Google Gemini CLI**, and **OpenAI Codex** against the vendors’ own public repositories and default setups showed paths to **remote code execution**, credential theft, repository tampering, and software supply-chain compromise without requiring privileged access. Researchers said the weakness lies primarily in the surrounding agent harnesses—tool permissions, execution controls, and sandboxing—rather than the underlying models. Reported exploitation paths included command-validation bypasses, unenforced shell restrictions, secret exposure through `/proc`, and persistent instruction poisoning across multi-pass workflows. Anthropic remediated **`CVE-2026-54316`** in Claude Code versions `0.2.54` through `2.1.162`; Google patched Gemini CLI versions before `0.39.1`, preview versions before `0.40.0-preview.3`, and `run-gemini-cli` GitHub Action versions before `0.1.22`; OpenAI mitigated Codex workflow risk by isolating agent runs and using read-only environments. The researchers said they found similar insecure patterns in more than 100 public repositories and reported no evidence of malicious exploitation in the wild.
Aug 7, 2026
Research from Novee Security found that default AI agent harnesses from major vendors could be abused to exfiltrate secrets, bypass trust boundaries, and chain individually approved actions into harmful outcomes. Elad Meged reported multiple issues affecting Anthropic, Google, and OpenAI tooling, arguing that the root problem lies in architectural trust decisions, approval logic, and cross-stage handoffs rather than prompt injection alone. One Google Gemini CLI issue was tracked as **`GHSA-wpqr-6v78-jr5g`** with a **CVSS 10.0** rating, while weaknesses were also identified in Anthropic's Claude Code Action and OpenAI's Codex CLI sandbox. The findings showed how controls can fail when agent components such as tools, memory, prompts, and execution environments trust each other too broadly. Researchers said Google's agent could be pushed into a supply-chain-style attack that wrote to its own GitHub repository, illustrating how safe-looking steps can combine into exploitable workflows. Vendors have added mitigations and fixes, but the repeated pattern across products points to a broader industry problem for organizations deploying autonomous agents on untrusted input, especially where human review is limited or absent.
Jul 31, 2026